collabmd 0.1.49 → 0.1.52

package/src/server/auth/session-cookie.js

@@ -1,19 +1,11 @@
 import { createHmac, timingSafeEqual } from 'node:crypto';
 
 function decodeBase64Url(value) {
-  const normalized = String(value ?? '')
-    .replace(/-/g, '+')
-    .replace(/_/g, '/');
-  const paddingLength = (4 - (normalized.length % 4)) % 4;
-  return Buffer.from(`${normalized}${'='.repeat(paddingLength)}`, 'base64');
+  return Buffer.from(String(value ?? ''), 'base64url');
 }
 
 function encodeBase64Url(value) {
-  return Buffer.from(value)
-    .toString('base64')
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replace(/=+$/g, '');
+  return Buffer.from(value).toString('base64url');
 }
 
 function parseCookieHeader(headerValue) {
@@ -78,6 +70,44 @@ export function createSignedCookieManager({
   cookiePath = '/',
   secret,
 }) {
+  // Authenticating one request can verify the same cookie several times
+  // (strategy check + expiry read + user lookup). Memoize per request object;
+  // the cookie-header check keeps it correct if headers ever change.
+  const readCache = new WeakMap();
+
+  function readSignedCookie(req) {
+    const token = parseCookieHeader(req.headers.cookie).get(cookieName);
+    if (!token) {
+      return null;
+    }
+
+    const separatorIndex = token.lastIndexOf('.');
+    if (separatorIndex <= 0) {
+      return null;
+    }
+
+    const encodedPayload = token.slice(0, separatorIndex);
+    const encodedSignature = token.slice(separatorIndex + 1);
+
+    try {
+      const expectedSignature = createSignature(encodedPayload, secret);
+      const actualSignature = decodeBase64Url(encodedSignature);
+
+      if (actualSignature.length !== expectedSignature.length) {
+        return null;
+      }
+
+      if (!timingSafeEqual(actualSignature, expectedSignature)) {
+        return null;
+      }
+
+      const payloadBuffer = decodeBase64Url(encodedPayload);
+      const payload = JSON.parse(payloadBuffer.toString('utf8'));
+      return payload && typeof payload === 'object' ? payload : null;
+    } catch {
+      return null;
+    }
+  }
   function createCookieAttributes(req, { expires = null } = {}) {
     const attributes = [
       'HttpOnly',
@@ -115,37 +145,18 @@ export function createSignedCookieManager({
     },
 
     read(req) {
-      const token = parseCookieHeader(req.headers.cookie).get(cookieName);
-      if (!token) {
-        return null;
-      }
-
-      const separatorIndex = token.lastIndexOf('.');
-      if (separatorIndex <= 0) {
-        return null;
-      }
-
-      const encodedPayload = token.slice(0, separatorIndex);
-      const encodedSignature = token.slice(separatorIndex + 1);
-
-      try {
-        const expectedSignature = createSignature(encodedPayload, secret);
-        const actualSignature = decodeBase64Url(encodedSignature);
-
-        if (actualSignature.length !== expectedSignature.length) {
-          return null;
-        }
-
-        if (!timingSafeEqual(actualSignature, expectedSignature)) {
-          return null;
+      if (req && typeof req === 'object') {
+        const cached = readCache.get(req);
+        if (cached !== undefined) {
+          return cached;
         }
 
-        const payloadBuffer = decodeBase64Url(encodedPayload);
-        const payload = JSON.parse(payloadBuffer.toString('utf8'));
-        return payload && typeof payload === 'object' ? payload : null;
-      } catch {
-        return null;
+        const result = readSignedCookie(req);
+        readCache.set(req, result);
+        return result;
       }
+
+      return readSignedCookie(req);
     },
   };
 }

package/src/server/config/env.js

@@ -1,4 +1,4 @@
-import { resolve } from 'path';
+import { basename, isAbsolute, relative, resolve } from 'path';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'url';
 
@@ -9,7 +9,7 @@ import {
   SUPPORTED_AUTH_STRATEGIES,
   createRandomAuthPassword,
   createRandomSessionSecret,
-} from '../auth/create-auth-service.js';
+} from '../auth/auth-constants.js';
 import { loadBuildInfo } from './build-info.js';
 import { isPerfLoggingEnabled } from './perf-logging.js';
 
@@ -199,6 +199,94 @@ export function resolveCliVaultDir(positionals = [], env = process.env) {
   return resolve(positionals[0] || env.COLLABMD_VAULT_DIR || '.');
 }
 
+const VAULT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+const VAULT_ID_HINT = 'Use letters, numbers, ".", "_", or "-" starting with a letter or number.';
+
+export function parseVaultList(rawValue) {
+  return normalizeCsvList(rawValue).map((entry) => {
+    const separatorIndex = entry.indexOf('=');
+    const hasName = separatorIndex > 0;
+    const rawDir = (hasName ? entry.slice(separatorIndex + 1) : entry).trim();
+    if (!rawDir) {
+      throw new Error(`Vault entry "${entry}" is missing a directory path.`);
+    }
+    const dir = resolve(rawDir);
+    const id = (hasName ? entry.slice(0, separatorIndex).trim() : basename(dir));
+    if (!VAULT_ID_PATTERN.test(id)) {
+      throw new Error(`Invalid vault id "${id}". ${VAULT_ID_HINT}`);
+    }
+    return { id, dir };
+  });
+}
+
+export function resolveConfiguredVaults(overrides = {}, env = process.env) {
+  if (Array.isArray(overrides.vaults)) {
+    return overrides.vaults.map(({ id, dir, repoUrl }) => {
+      if (!VAULT_ID_PATTERN.test(String(id ?? ''))) {
+        throw new Error(`Invalid vault id "${id}". ${VAULT_ID_HINT}`);
+      }
+      return { id, dir: resolve(dir), repoUrl: normalizeOptionalString(repoUrl) };
+    });
+  }
+  // ponytail: explicit directory (CLI positional) wins over the operator list
+  if (overrides.vaultDir) {
+    const dir = resolve(overrides.vaultDir);
+    return [{ id: basename(dir), dir }];
+  }
+  const rawList = normalizeOptionalString(env.COLLABMD_VAULTS);
+  if (!rawList) {
+    const dir = resolveConfiguredVaultDir(overrides, env);
+    return [{ id: basename(dir), dir }];
+  }
+  const vaults = parseVaultList(rawList);
+  const seenIds = new Set();
+  for (const vault of vaults) {
+    if (seenIds.has(vault.id)) {
+      throw new Error(`Duplicate vault id "${vault.id}" in COLLABMD_VAULTS.`);
+    }
+    seenIds.add(vault.id);
+  }
+  for (let i = 0; i < vaults.length; i += 1) {
+    for (let j = i + 1; j < vaults.length; j += 1) {
+      const between = relative(vaults[i].dir, vaults[j].dir);
+      if (between === '' || (!between.startsWith('..') && !isAbsolute(between))) {
+        throw new Error(`Vaults "${vaults[i].id}" and "${vaults[j].id}" overlap. Vault directories must not nest.`);
+      }
+    }
+  }
+  return vaults;
+}
+
+export function mangleVaultIdForEnv(vaultId) {
+  return String(vaultId ?? '').toUpperCase().replace(/[^A-Z0-9]/g, '_');
+}
+
+// ponytail: explicit repoUrl wins, then COLLABMD_GIT_REPO_URL_<ID>, then the shared URL for the primary
+export function resolveVaultRepoUrls(vaultDefs = [], overrides = {}, env = process.env) {
+  const globalRepoUrl = normalizeOptionalString(overrides.remote?.repoUrl ?? overrides.git?.remote?.repoUrl ?? env.COLLABMD_GIT_REPO_URL);
+  const bySuffix = new Map();
+  for (const def of vaultDefs) {
+    const suffix = mangleVaultIdForEnv(def.id);
+    if (!bySuffix.has(suffix)) {
+      bySuffix.set(suffix, []);
+    }
+    bySuffix.get(suffix).push(def.id);
+  }
+  return vaultDefs.map((def, index) => {
+    if (def.repoUrl) {
+      return def;
+    }
+    const suffix = mangleVaultIdForEnv(def.id);
+    const varName = `COLLABMD_GIT_REPO_URL_${suffix}`;
+    const perVaultUrl = normalizeOptionalString(env[varName]);
+    if (perVaultUrl && bySuffix.get(suffix).length > 1) {
+      throw new Error(`Ambiguous git remote: vaults ${bySuffix.get(suffix).map((id) => `"${id}"`).join(' and ')} share ${varName}.`);
+    }
+    return { ...def, repoUrl: perVaultUrl || (index === 0 ? globalRepoUrl : '') };
+  });
+}
+
 function getDefaultHost(nodeEnv) {
   return nodeEnv === 'production' ? '0.0.0.0' : '127.0.0.1';
 }
@@ -208,7 +296,7 @@ function resolveOptionalPath(filePath) {
   return normalized ? resolve(normalized) : '';
 }
 
-function loadGitConfig(overrides = {}) {
+function loadGitConfig(overrides = {}, { vaultRepoUrls = [] } = {}) {
   const remoteOverrides = overrides.remote ?? {};
   const identityOverrides = overrides.identity ?? {};
   const enabled = overrides.enabled ?? (process.env.COLLABMD_GIT_ENABLED !== 'false');
@@ -240,7 +328,7 @@ function loadGitConfig(overrides = {}) {
     remoteOverrides.sshKnownHostsFile
     ?? process.env.COLLABMD_GIT_SSH_KNOWN_HOSTS_FILE,
   );
-  const remoteEnabled = repoUrl.length > 0;
+  const remoteEnabled = repoUrl.length > 0 || vaultRepoUrls.some((entry) => String(entry ?? '').length > 0);
 
   if (remoteEnabled && !sshPrivateKeyFile && !sshPrivateKeyBase64) {
     throw new Error(
@@ -452,7 +540,9 @@ function resolvePublicDir(nodeEnv) {
 
 export function loadConfig(overrides = {}) {
   const nodeEnv = process.env.NODE_ENV || 'development';
-  const vaultDir = resolveConfiguredVaultDir(overrides);
+  const vaults = resolveVaultRepoUrls(resolveConfiguredVaults(overrides), overrides);
+  // ponytail: vaultDir stays the primary vault; other vaults resolve through the registry
+  const vaultDir = overrides.vaultDir || vaults[0].dir;
   const basePath = normalizeAppBasePath(process.env.BASE_PATH || '');
   const publicDir = resolvePublicDir(nodeEnv);
   const authOverrides = overrides.auth ?? {};
@@ -469,7 +559,7 @@ export function loadConfig(overrides = {}) {
   const oidc = authStrategy === AUTH_STRATEGY_OIDC
     ? loadOidcConfig(authOverrides.oidc, { basePath })
     : null;
-  const git = loadGitConfig(overrides.git);
+  const git = loadGitConfig(overrides.git, { vaultRepoUrls: vaults.map((vault) => vault.repoUrl) });
   const hosted = loadHostedConfig(overrides.hosted, { authStrategy, vaultDir });
   const agentAccess = loadAgentAccessConfig(overrides.agentAccess, {
     basePath,
@@ -531,6 +621,7 @@ export function loadConfig(overrides = {}) {
     plantumlServerUrl: process.env.PLANTUML_SERVER_URL || 'https://www.plantuml.com/plantuml',
     publicDir,
     vaultDir,
+    vaults,
     publicWsBaseUrl: process.env.PUBLIC_WS_BASE_URL || '',
     testWsRoomHydrateDelayMs: parsePositiveInt(process.env.TEST_WS_ROOM_HYDRATE_DELAY_MS, 0),
     wikiLinkAutoCreate: process.env.COLLABMD_WIKI_LINK_AUTO_CREATE !== 'false',

package/src/server/create-app-server.js

@@ -6,32 +6,18 @@ import { AgentConnectionService } from './application/agent-connection-service.j
 import { AgentContentService } from './application/agent-content-service.js';
 import { createAuthService } from './auth/create-auth-service.js';
 import { logPerfEvent } from './config/perf-logging.js';
-import { BacklinkIndex } from './domain/backlink-index.js';
-import { BaseQueryService } from './domain/bases/base-query-service.js';
-import { CollaborationDocumentStore } from './domain/collaboration/collaboration-document-store.js';
-import { CollaborationRoom } from './domain/collaboration/collaboration-room.js';
 import { renderDocx } from './domain/docx-exporter.js';
-import { GitService } from './infrastructure/git/git-service.js';
-import { ensureCollabMetadataGitExclude } from './infrastructure/git/local-exclude.js';
 import { GitHubAppClient } from './infrastructure/github/github-app-client.js';
 import { GitHubSetupFlow } from './infrastructure/github/github-setup-flow.js';
 import { HostedWorkspaceService } from './domain/hosted-workspace.js';
 import { PlantUmlRenderer } from './infrastructure/plantuml/plantuml-renderer.js';
 import { StructurizrWorkspaceService } from './infrastructure/structurizr/structurizr-workspace-service.js';
-import { RoomRegistry } from './domain/collaboration/room-registry.js';
-import { RipgrepSearchService } from './domain/ripgrep-search-service.js';
 import { createRequestHandler } from './infrastructure/http/create-request-handler.js';
 import { AgentConnectionStore } from './infrastructure/persistence/agent-connection-store.js';
 import { HostedMetadataStore } from './infrastructure/persistence/hosted-metadata-store.js';
-import { VaultFileStore } from './infrastructure/persistence/vault-file-store.js';
 import { attachCollaborationGateway } from './infrastructure/websocket/attach-collaboration-gateway.js';
-import { isDrawioLeaseRoom } from '../domain/drawio-room.js';
-import { WORKSPACE_ROOM_NAME } from '../domain/workspace-room.js';
-import { FileSystemSyncService } from './infrastructure/workspace/file-system-sync-service.js';
-import { WorkspaceReconciliation } from './application/workspace-reconciliation.js';
-import { createWorkspaceStateFileSystemAdapter } from './infrastructure/workspace/workspace-state-file-system-adapter.js';
 import { createSignedCookieManager } from './auth/session-cookie.js';
-import { workspaceStateMetadataEqual } from './domain/workspace-state.js';
+import { createVaultRegistry } from './vault-registry.js';
 
 function getDisplayHost(host) {
   return host === '127.0.0.1' ? 'localhost' : host;
@@ -76,16 +62,20 @@ export function createAppServer(config = loadConfig()) {
         githubAppClient,
       })
     : null;
-  const vaultFileStore = new VaultFileStore({ vaultDir: config.vaultDir });
-  const backlinkIndex = new BacklinkIndex({ vaultFileStore });
-  let fileSystemSyncService = null;
-  let workspaceMutationCoordinator = null;
-  const baseQueryService = new BaseQueryService({
-    maxResultRows: config.maxBaseQueryRows,
-    vaultFileStore,
-    workspaceStateProvider: () => workspaceMutationCoordinator?.workspaceState ?? null,
-    workspaceStateSynchronizer: () => fileSystemSyncService?.flushPendingChanges?.(),
-  });
+  const testControls = {
+    wsRoomHydrateDelayMs: Math.max(0, Number(config.testWsRoomHydrateDelayMs || 0)),
+  };
+  // ponytail: one live context per vault; agent/hosted/structurizr stay on the primary this slice
+  const vaultRegistry = createVaultRegistry({ config, testControls });
+  const primary = vaultRegistry.getPrimaryContext();
+  const vaultFileStore = primary.vaultFileStore;
+  const backlinkIndex = primary.backlinkIndex;
+  const baseQueryService = primary.baseQueryService;
+  const gitService = primary.gitService;
+  const searchService = primary.searchService;
+  const roomRegistry = primary.roomRegistry;
+  const workspaceMutationCoordinator = primary.workspaceMutationCoordinator;
+  const fileSystemSyncService = primary.fileSystemSyncService;
   const plantUmlRenderer = new PlantUmlRenderer({
     serverUrl: config.plantumlServerUrl,
   });
@@ -95,56 +85,6 @@ export function createAppServer(config = loadConfig()) {
     trustedExecutableDsl: config.structurizr?.trustedExecutableDsl,
     vaultDir: config.vaultDir,
   });
-  const gitService = new GitService({
-    commandEnv: config.git?.commandEnv,
-    enabled: config.gitEnabled,
-    vaultDir: config.vaultDir,
-  });
-  const searchService = new RipgrepSearchService({
-    maxBufferBytes: config.searchMaxBufferBytes,
-    maxFileSize: config.searchMaxFileSize,
-    perfLoggingEnabled: config.perfLoggingEnabled,
-    vaultDir: config.vaultDir,
-  });
-  const testControls = {
-    wsRoomHydrateDelayMs: Math.max(0, Number(config.testWsRoomHydrateDelayMs || 0)),
-  };
-  const roomRegistry = new RoomRegistry({
-    createRoom: ({ name, onEmpty }) => {
-      const isTransientRoom = name === '__lobby__' || name === WORKSPACE_ROOM_NAME || isDrawioLeaseRoom(name);
-      const room = new CollaborationRoom({
-        documentStore: new CollaborationDocumentStore({
-          backlinkIndex: isTransientRoom ? null : backlinkIndex,
-          name,
-          vaultFileStore: isTransientRoom ? null : vaultFileStore,
-        }),
-        getHydrateDelayMs: () => testControls.wsRoomHydrateDelayMs,
-        idleGraceMs: config.wsRoomIdleGraceMs,
-        maxInitialSyncBytes: config.maxInitialSyncBytes,
-        maxBufferedAmountBytes: config.wsMaxBufferedAmountBytes,
-        name,
-        onEmpty,
-        perfLoggingEnabled: config.perfLoggingEnabled,
-      });
-
-      if (name === WORKSPACE_ROOM_NAME && workspaceMutationCoordinator?.workspaceState) {
-        room.replaceWorkspaceEntries(workspaceMutationCoordinator.workspaceState.entries, {
-          generatedAt: workspaceMutationCoordinator.workspaceState.scannedAt,
-        });
-      }
-
-      return room;
-    },
-  });
-  workspaceMutationCoordinator = new WorkspaceReconciliation({
-    backlinkIndex,
-    baseQueryService,
-    roomRegistry,
-    vaultFileStore,
-    workspaceStateAdapter: createWorkspaceStateFileSystemAdapter({
-      vaultDir: vaultFileStore.vaultDir,
-    }),
-  });
   const agentConnectionStore = new AgentConnectionStore({
     dbPath: config.agentAccess.dbPath,
   });
@@ -156,18 +96,13 @@ export function createAppServer(config = loadConfig()) {
   });
   const agentContentService = new AgentContentService({
     backlinkIndex,
+    baseQueryService,
     plantUmlRenderer,
     roomRegistry,
     searchService,
     vaultFileStore,
     workspaceMutationCoordinator,
   });
-  vaultFileStore.setManagedWriteTracker(workspaceMutationCoordinator);
-  fileSystemSyncService = new FileSystemSyncService({
-    mutationCoordinator: workspaceMutationCoordinator,
-    perfLoggingEnabled: config.perfLoggingEnabled,
-    vaultFileStore,
-  });
   const requestHandler = createRequestHandler(
     config,
     authService,
@@ -189,6 +124,7 @@ export function createAppServer(config = loadConfig()) {
       connectionService: agentConnectionService,
       contentService: agentContentService,
     },
+    vaultRegistry,
   );
   const httpServer = createServer((req, res) => {
     requestHandler(req, res).catch((error) => {
@@ -211,6 +147,7 @@ export function createAppServer(config = loadConfig()) {
     roomRegistry,
     wsBasePath: config.wsBasePath,
     hostedWorkspaceService,
+    vaultRegistry,
   });
 
   let shutdownPromise = null;
@@ -219,81 +156,14 @@ export function createAppServer(config = loadConfig()) {
   async function listen() {
     const startupStartedAt = Date.now();
 
-    if (await gitService.isGitRepo()) {
-      await ensureCollabMetadataGitExclude(config.vaultDir);
-    }
     await hostedWorkspaceService.initialize();
     if (config.agentAccess.enabled && config.auth.strategy !== 'none') {
       await agentConnectionService.initialize();
     }
 
-    const searchCapabilityStartedAt = Date.now();
-    config.search = await searchService.initialize();
-    logPerfEvent(config.perfLoggingEnabled, 'startup', {
-      available: config.search.available,
-      durationMs: Date.now() - searchCapabilityStartedAt,
-      phase: 'search-capability',
-    });
-
-    const initialWorkspaceScanStartedAt = Date.now();
-    const initialWorkspaceSnapshot = await vaultFileStore.scanWorkspaceState();
-    vaultFileCount = initialWorkspaceSnapshot.vaultFileCount ?? 0;
-    logPerfEvent(config.perfLoggingEnabled, 'startup', {
-      durationMs: Date.now() - initialWorkspaceScanStartedAt,
-      phase: 'workspace-scan',
-      vaultFileCount,
-    });
-
-    const backlinkBuildStartedAt = Date.now();
-    await backlinkIndex.build({ workspaceState: initialWorkspaceSnapshot });
-    logPerfEvent(config.perfLoggingEnabled, 'startup', {
-      durationMs: Date.now() - backlinkBuildStartedAt,
-      markdownFileCount: initialWorkspaceSnapshot.markdownPaths?.length ?? 0,
-      phase: 'backlink-build',
-    });
-
-    const liveWorkspaceScanStartedAt = Date.now();
-    const liveWorkspaceSnapshot = await vaultFileStore.scanWorkspaceState();
-    const workspaceChangedDuringStartup = !workspaceStateMetadataEqual(initialWorkspaceSnapshot, liveWorkspaceSnapshot);
-    vaultFileCount = liveWorkspaceSnapshot.vaultFileCount ?? vaultFileCount;
-    logPerfEvent(config.perfLoggingEnabled, 'startup', {
-      changedDuringStartup: workspaceChangedDuringStartup,
-      durationMs: Date.now() - liveWorkspaceScanStartedAt,
-      phase: 'workspace-rescan',
-      vaultFileCount,
-    });
-
-    if (workspaceChangedDuringStartup) {
-      const backlinkRebuildStartedAt = Date.now();
-      await backlinkIndex.build({ workspaceState: liveWorkspaceSnapshot });
-      logPerfEvent(config.perfLoggingEnabled, 'startup', {
-        durationMs: Date.now() - backlinkRebuildStartedAt,
-        markdownFileCount: liveWorkspaceSnapshot.markdownPaths?.length ?? 0,
-        phase: 'backlink-rebuild',
-      });
-    }
-
-    const workspaceInitStartedAt = Date.now();
-    await workspaceMutationCoordinator.initialize({ snapshot: liveWorkspaceSnapshot });
-    logPerfEvent(config.perfLoggingEnabled, 'startup', {
-      durationMs: Date.now() - workspaceInitStartedAt,
-      phase: 'workspace-init',
-    });
-
-    if (config.fileWatcherEnabled !== false) {
-      const watcherStartStartedAt = Date.now();
-      await fileSystemSyncService.start({ snapshot: liveWorkspaceSnapshot });
-      logPerfEvent(config.perfLoggingEnabled, 'startup', {
-        durationMs: Date.now() - watcherStartStartedAt,
-        phase: 'watcher-start',
-      });
-    } else {
-      fileSystemSyncService.initializeFromSnapshot({ snapshot: liveWorkspaceSnapshot });
-      logPerfEvent(config.perfLoggingEnabled, 'startup', {
-        durationMs: 0,
-        phase: 'watcher-skipped',
-      });
-    }
+    const { searchCapability, snapshot: liveWorkspaceSnapshot, vaultFileCount: primaryFileCount } = await vaultRegistry.initializePrimary();
+    config.search = searchCapability;
+    vaultFileCount = primaryFileCount;
 
     return new Promise((resolve, reject) => {
       const listenStartedAt = Date.now();
@@ -331,8 +201,7 @@ export function createAppServer(config = loadConfig()) {
 
     shutdownPromise = (async () => {
       await collaborationGateway.close();
-      await fileSystemSyncService.close();
-      await roomRegistry.reset();
+      await vaultRegistry.closeAll();
       await Promise.all([
         closeHttpServer(httpServer),
         config.git?.cleanup?.(),
@@ -367,6 +236,7 @@ export function createAppServer(config = loadConfig()) {
       testControls.wsRoomHydrateDelayMs = Math.max(0, Number(delayMs) || 0);
     },
     vaultFileStore,
+    vaultRegistry,
     get vaultFileCount() { return vaultFileCount; },
   };
 }

package/src/server/domain/backlink-index.js

@@ -21,16 +21,6 @@ import { mapWithConcurrency } from '../shared/async-utils.js';
 
 const BACKLINK_BUILD_CONCURRENCY = 8;
 
-function createDeferred() {
-  let resolve;
-  let reject;
-  const promise = new Promise((nextResolve, nextReject) => {
-    resolve = nextResolve;
-    reject = nextReject;
-  });
-  return { promise, reject, resolve };
-}
-
 export class BacklinkIndex {
   constructor({
     rebuildDelayMs = 150,
@@ -83,7 +73,7 @@ export class BacklinkIndex {
       this._latestRequestedWorkspaceState = workspaceState;
     }
     if (!this._scheduledBuildDeferred) {
-      this._scheduledBuildDeferred = createDeferred();
+      this._scheduledBuildDeferred = Promise.withResolvers();
     }
 
     if (this._scheduledBuildTimer) {

package/src/server/domain/bases/base-query-results.js

@@ -103,8 +103,12 @@ function createSummaryPayload(columns, rows, summaries, definition, snapshot, th
 
 function createCsv(rows, columns) {
   const escapeCell = (value) => {
-    const text = String(value ?? '');
-    if (/[,"\n]/u.test(text)) {
+    let text = toDisplayText(value);
+    // CSV quoting alone does not prevent spreadsheets from evaluating formulas.
+    if (typeof value !== 'number' && /^[\s\p{Cc}]*[=+@-]|^[\t\r\n]/u.test(text)) {
+      text = `'${text}`;
+    }
+    if (/[,"\r\n]/u.test(text)) {
       return `"${text.replace(/"/g, '""')}"`;
     }
     return text;
@@ -112,7 +116,7 @@ function createCsv(rows, columns) {
 
   const lines = [
     columns.map((column) => escapeCell(column.label)).join(','),
-    ...rows.map((row) => columns.map((column) => escapeCell(toDisplayText(row.rawCells[column.id]))).join(',')),
+    ...rows.map((row) => columns.map((column) => escapeCell(row.rawCells[column.id])).join(',')),
   ];
   return `${lines.join('\n')}\n`;
 }

package/src/server/domain/bases/base-query-service.js

@@ -1,3 +1,4 @@
+import { scheduler } from 'node:timers/promises';
 import {
   buildColumns,
   collectEvaluatedPropertyIds,
@@ -25,12 +26,6 @@ export { serializeBaseDefinition } from './base-definition.js';
 
 const BASE_QUERY_ROW_CHUNK_SIZE = 50;
 
-function yieldToEventLoop() {
-  return new Promise((resolve) => {
-    setImmediate(resolve);
-  });
-}
-
 function buildSortChain(activeView) {
   const entries = [];
   (activeView.sort ?? []).forEach((sortConfig) => {
@@ -292,7 +287,7 @@ export class BaseQueryService {
       }
 
       if (chunkEnd < filePaths.length) {
-        await yieldToEventLoop();
+        await scheduler.yield();
       }
     }